CVE-2026-20027

Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restart, resulting in an interruption of packet inspection. This vulnerabili...

CVE-2023-43547

Memory corruption while invoking IOCTLs calls in Automotive Multimedia...

CVE-2025-70974

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an...

WordPress plugin Amelia 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of resource-limiting controls in the gRPC, HTTPS, and HTTP3 server implementations. An attacker can exhaust memory and cause the server to degrade or crash by opening...

PT-2026-1872

Name of the Vulnerable Software and Affected Versions GL.Inet GL.Inet AX1800 versions 4.6.4 and 4.6.8 Description An issue exists in the GL.iNet custom opkg wrapper script located at /usr/libexec/opkg-call within the GL.Inet AX1800. The script operates with root privileges when activated through...

CVE-2026-20026

CVE-2026-20026 (and related 20027) affect Cisco Snort 3 in multiple Cisco products (e.g., IOS XE, Meraki, FTD). Root cause: buffer handling error during DCE/RPC request processing leading to a use-after-free read (20026) and, in another variant, a possible out-of-bounds read (20027). Impacts: una...

Out-of-bounds Write

wasm3 is vulnerable to Out-of-bounds Write. The vulnerability is due to improper handling of slot setting and indirect function calls in opSetSloti32 and opCallIndirect, which allows a local attacker to manipulate execution and trigger memory corruption...

CVE-2019-16144

An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield during API calls...

CVE-2022-27487

A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS...

CVE-2025-9611 Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validation

Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended...

Cisco UTD SNORT IPS Engine Software和Cisco Secure Firewall Threat Defense Software 资源管理错误漏洞

Cisco UTD SNORT IPS Engine Software and Cisco Secure Firewall Threat Defense Software are both products of Cisco Corporation.Cisco UTD SNORT IPS Engine Software is an intrusion detection and defense Cisco Secure Firewall Threat Defense Software is a firewall operating system. A resource managemen...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000435)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000435 advisory. An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dwspiirq and...

axios4go 竞争条件问题漏洞

axios4go is an HTTP client library by the individual developers at Rez Moss. A competitive condition issue vulnerability exists in axios4go versions prior to 0.6.4, which stems from the presence of a competitive condition in shared HTTP client configurations, which could lead to modification of...

SUSE CVE-2025-62190

Mattermost versions 11.0.x = 11.0.4, 10.12.x = 10.12.2, 10.11.x = 10.11.6 and Mattermost Calls versions =1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious...

PT-2026-30648

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A memory corruption issue exists when using deprecated DMABUF IOCTL calls to manage video memory. Recommendations At the moment, there is no information about a...

PT-2026-1242

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the amlogic-a4 Real Time Clock RTC driver. A double free issue occurs because the clock obtained via devm clk get enabled is automatically managed by...

CVE-2025-15413 wasm3 m3_exec.h op_CallIndirect memory corruption

A vulnerability was detected in wasm3 up to 0.5.0. Impacted is the function opSetSloti32/opCallIndirect of the file m3exec.h. Performing a manipulation results in memory corruption. The attack needs to be approached locally. The exploit is now public and may be used. Unfortunately, the project ha...

PT-2026-26134

Name of the Vulnerable Software and Affected Versions nghttp2 versions prior to 1.68.1 Description nghttp2 is a C implementation of the Hypertext Transfer Protocol version 2. Versions of nghttp2 prior to 1.68.1 are susceptible to a denial-of-service condition. This occurs because the library does...

GO-2025-4254 Mattermost has CSRF vulnerability via Calls Widget page in github.com/mattermost/mattermost-plugin-calls

Mattermost has CSRF vulnerability via Calls Widget page in github.com/mattermost/mattermost-plugin-calls...